elastic / elastic/ecs

forwarded_ip - no place to put geo ... fields

Open
#523 3 comments 1 reaction 0 assignees View on GitHub
discuss
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

We have often original IP/X-Forwarded-for IP address in logs. Sometimes together with its geo information, sometimes we call geoip filter on it. Currently there is just network.forwarded_ip field which is very confusing and can not be used to store additional fields like geo. I think this should be replaced with something client.original.*, server.original.*. The original field is the original (x-forwarded-for) IP address and can also store other fields as well (client.original.geo.*, ...). Also it is very clear to which it is related to - client.original is related to client, server.original to server.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.